CVE-2026-25940 jsPDF PoC

A proof-of-concept for CVE-2026-25940 demonstrating how specially crafted AcroForm radio button appearances can trigger embedded JavaScript in vulnerable PDF viewers (e.g., Foxit). The repo includes a Node-based generator and a browser viewer harness to exercise different parsing paths.

⚠️ Use only in isolated, non-production environments. The sample payloads intentionally execute JavaScript and may invoke network requests or external programs. Do not open the generated PDF with untrusted viewers on a host you care about.

Repo Contents

• poc.js: Generates a malicious PDF with multiple radio button options and distinct appearance streams to showcase different behaviors.
• viewer.html: Minimal viewer harness to generate the PoC in-browser or load an existing sample, and render it both natively (iframe) and via PDF.js.
• package.json: Declares the jsPDF dependency for the Node PoC.

Prerequisites

• Node.js 18+ and npm.

Setup

1. Install dependencies:
   root@kitploit:~

   npm install
   

2. (Optional) Serve the viewer locally for cleaner loading of the HTML/JS: